The vulnerability exists in the icns_decompress function of the file-icns plugin in GIMP, where it reads from the mask data buffer without verifying if the read cursor exceeds the allocated resource size. A crafted ICNS file with a truncated mask resource can trigger an out-of-bounds read, leaking heap memory contents as alpha channel pixel values or causing a crash if unmapped memory is accessed. The flaw has a CVSS 3.1 score of 7.1 (high severity) with local attack vector, low complexity, no privileges required, and user interaction needed. Red Hat has published an advisory and released patches for affected products including Red Hat Enterprise Linux 9 variants.

Successful exploitation can disclose sensitive heap memory contents, potentially leaking confidential information such as cryptographic keys or memory addresses, which could aid further attacks. Additionally, the vulnerability can cause application crashes leading to denial of service. The attack requires a user to open a malicious ICNS image file with GIMP, limiting remote exploitation. No known exploits in the wild have been reported.

A security update fixing this vulnerability is available and should be applied. Until patched, users should avoid opening ICNS files from untrusted sources with GIMP. Red Hat provides updated GIMP packages for Red Hat Enterprise Linux 9 and related variants. No other mitigations are specified.